[flagged]
What's that link?
Show HN: Curl modified to impersonate Firefox and mimic its TLS handshake
21–30 of 62 posts
Re: Show HN: Curl modified to impersonate Firefox and mimic its TLS handshake
#22I run a MITM proxy for adblocking/general filtering and within the past little while I've noticed CloudFlare and other "bot protection" tends to get me blocked out of increasingly more sites I come across in search results, so this will be very useful for fixing that. However, I should caution that in this era of companies being particularly user-hostile and authoritarian, especially Big Tech, I would be more careful…
Maybe I'm just a techno-optimist, but I suspect big tech companies don't give a hoot about you running "unapproved" software, but rather care about their services being abused and "unapproved" software is just a useful signal that fails on a tiny percentage of total legit users.
Re: Show HN: Curl modified to impersonate Firefox and mimic its TLS handshake
#23I run a MITM proxy for adblocking/general filtering and within the past little while I've noticed CloudFlare and other "bot protection" tends to get me blocked out of increasingly more sites I come across in search results, so this will be very useful for fixing that. However, I should caution that in this era of companies being particularly user-hostile and authoritarian, especially Big Tech, I would be more careful…
I've noticed even GitHub has a login wall now for comments on open source projects. They truncate them if you aren't logged in, similar to reddit on mobile, instagram, twitter, etc. Hopefully the mobile version doesn't start pushing you to install some crappy apps where you can't use features like tabbed browsing, tab sync with another machine, etc.
Re: Show HN: Curl modified to impersonate Firefox and mimic its TLS handshake
#24I run a MITM proxy for adblocking/general filtering and within the past little while I've noticed CloudFlare and other "bot protection" tends to get me blocked out of increasingly more sites I come across in search results, so this will be very useful for fixing that. However, I should caution that in this era of companies being particularly user-hostile and authoritarian, especially Big Tech, I would be more careful…
Maybe I'm just a techno-optimist, but I suspect big tech companies don't give a hoot about you running "unapproved" software, but rather care about their services being abused and "unapproved" software is just a useful signal that fails on a tiny percentage of total legit users.
You are a lot more charitable than I am. I believe the big tech companies use dark patterns to get us to sign up, improve their metrics and hoover up our data.
Re: Show HN: Curl modified to impersonate Firefox and mimic its TLS handshake
#25I run a MITM proxy for adblocking/general filtering and within the past little while I've noticed CloudFlare and other "bot protection" tends to get me blocked out of increasingly more sites I come across in search results, so this will be very useful for fixing that. However, I should caution that in this era of companies being particularly user-hostile and authoritarian, especially Big Tech, I would be more careful…
Maybe I'm just a techno-optimist, but I suspect big tech companies don't give a hoot about you running "unapproved" software, but rather care about their services being abused and "unapproved" software is just a useful signal that fails on a tiny percentage of total legit users.
This is a distinction without a difference.
Re: Show HN: Curl modified to impersonate Firefox and mimic its TLS handshake
#26>impersonate Firefox 95 you should really be impersonating an ESR version (eg. 91). Versions from the release channel is updated every month or so, and everyone has autoupdate enabled. Therefore unless you keep it up to date, your fingerprint is going to stick out like a sore thumb in a few months. On the other hand, ESR sticks to one version and shouldn't change significantly during its one year lifetime. It's still…
I think ESR is the way to go too, but either way, I wonder if some tests can be written to confirm the coverage/similarity of the requests? It would entail automating a both Firefox session and the recording of network traffic, and feels like it might end up as bikeshedding.
Re: Show HN: Curl modified to impersonate Firefox and mimic its TLS handshake
#27>impersonate Firefox 95 you should really be impersonating an ESR version (eg. 91). Versions from the release channel is updated every month or so, and everyone has autoupdate enabled. Therefore unless you keep it up to date, your fingerprint is going to stick out like a sore thumb in a few months. On the other hand, ESR sticks to one version and shouldn't change significantly during its one year lifetime. It's still…
Thanks for the suggestion, I had no idea ESR was a thing. I've just added support for Firefox ESR 91 (it was pretty similar and required adding one cipher to the cipher list and changing the user agent).
Re: Show HN: Curl modified to impersonate Firefox and mimic its TLS handshake
#28Given the relative market shares it might make more sense to impersonate Chrome.
I will try to impersonate Chrome next, However, I suspect this is going to be more challenging. Chrome uses BoringSSL, which curl does not support. So it means either enforcing curl to compile with BoringSSL or modifying NSS to look like BoringSSL.
Re: Show HN: Curl modified to impersonate Firefox and mimic its TLS handshake
#29Do you plan on getting this merged back into curl with an option to enable it? I can see that being useful for some people.
I hope to do so in the future, for now the implementation is extremely hacky so I doubt it can get accepted into curl.
Re: Show HN: Curl modified to impersonate Firefox and mimic its TLS handshake
#30I run a MITM proxy for adblocking/general filtering and within the past little while I've noticed CloudFlare and other "bot protection" tends to get me blocked out of increasingly more sites I come across in search results, so this will be very useful for fixing that. However, I should caution that in this era of companies being particularly user-hostile and authoritarian, especially Big Tech, I would be more careful…
Cloudflare is likely one of the worst things that has happened to the internet in recent history.
Like, I get the need for some protective mechanisms for interactive content/posting/etc, but there should be zero cases where a simple HTTP 200 GET requires javascript/client side crap. If they serve me a slightly stale version of the remote resource (5 minutes/whatnot) that's fine.
They've effectively just turned into a google protection racket. Small/special purpose search/archive tools are just stonewalled.